1.1.3. Processes

At the heart of Linux lies the concept of a process. Understanding this concept will help you keep control of your login session as a user.

A process is an independently running program that has its own set of resources.

On Linux, the finite resources of the system, like the memory and the disks, are managed by one all-powerful program called the kernel. Everything else on the system is a process.

Thus, before you log in, your terminal is monitored by a getty process. After you log in, the getty process dies (a new one is started by the kernel when you log out) and your terminal is managed by your shell, which is a different process. The shell then creates a new process each time you enter a command. The creation of a new process is called forking, because one process splits into two.

If you are using the X Window System, each process starts up one or more windows. Thus, the window in which you are typing commands is owned by an xterm process. That process forks a shell to run within the window. And that shell forks yet more processes as you enter commands.

To see the processes you are running, enter the command ps.

Example 1. Running the comand ps:
$ ps

PID     TTY     TIME     CMD
4490     pts/4     00:00:00      bash
15029     pts/4     00:00:00      ps

You aren't restricted to seeing your own processes. Look for a minute at all the processes on the system. You may be surprised how many processes you are running, especially if you are using X. One of the processes is the ps command itself, which of course dies as soon as the output is displayed.

Example 2. Running the comand ps with the aux parameters:
$ ps aux

   where
ps     - list my processes
ps a     - list processes of all users
ps au     - list all processes in user format
ps aux     - including processes that have no controlling terminal (such as daemons started at runtime)

Here are the output of the ps aux command:

where
    PID    - process identity number
    CPU    - central procecessing unit time
    SIZE   - size of text+data+stack
    RSS    - kilobytes of program in memory
    TTY    - controling terminal (teletype)
    STAT   - status of the process:
       S  sleeping
       T  stopped
       R  running (or ready to run)
       Z  zombie

The first field in the ps output is a unique identifier for the process (PID). If you have a runaway process that you can't get rid of through Ctrl-C or other means, you can kill it with the command kill <PID number>.

Example 3. Killing a process by PID:
$ kill 11752

The TTY field shows which terminal the process is running on, if any. (Everything run from a shell uses a terminal, of course, but background daemons don't have a terminal).

The STAT field shows what state the process is in. If the shell is suspended, this field shows an S. In the example 2, an Emacs editing session is running, but it's suspended using Ctrl-Z. This is shown by the T in its STAT field. The last process shown for user kalle is the ps that is generating all this input; its state, of course, is R because it is running.

The TIME field shows how much CPU time the processes have used.